NginxProxyManager / NginxProxyManager/nginx-proxy-manager

[Feature Request] Allow issuing different key sizes, setting default key sizes for both RSA and ECDSA, allowing use of more than one certificate per proxy_host

Open
#5,569 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
TypeScript
Stars
34.2k
Forks
3.9k
Avg merge
21h 12m
Merged PRs (30d)
20

Description

Is your feature request related to a problem? Please describe.
Let's Encrypt supports RSA keys between 2048 and 4096, and ECDSA P-256 and P384

Describe the solution you'd like
In the Certificates menu tab, when requesting a certificate from there, allow the following key sizes:

  • RSA 2048
  • RSA 3072
  • RSA 4096
  • ECDSA 256
  • ECDSA 384

Could also be beneficial to have a settable "default key size" and mirror the same dropdown.
Default RSA Key Size: (2048, 3072, 4096)
Default ECDSA Key Size: (256, 384)

The certbot arguments are as follows:
--key-type ecdsa --elliptic-curve secp256r1
--key-type ecdsa --elliptic-curve secp384r1
--key-type rsa --rsa-key-size 2048
--key-type rsa --rsa-key-size 3072
--key-type rsa --rsa-key-size 4096

Another consideration: to support the maximum number of ciphers possible, modern versions of Nginx support multiple ssl_certificate and ssl_certificate_key directives. When configuring a standard nginx instance, the following would prioritize ECDSA, but allow RSA fallback, and show both available for negotiation through a service like ssllabs or the testssl.sh project:

ssl_certificate /path/to/ecdsa.crt;
ssl_certificate_key /path/to/ecdsa.key;
ssl_certificate /path/to/rsa.crt;
ssl_certificate_key /path/to/rsa.key;

The request for the above is to allow either issuing 2 certificates at proxy creation time, or creating the certificates through the certificate tab, and be able to link both of them to any given proxy host. a quick check of the public key could then inform the order of the ssl_certificate/ssl_certificate_key statements in the proxy host configurations.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in the Certificates menu and the proxy host configuration flow, then trace how certificate requests pass the listed Certbot options and how Nginx certificate directives are generated. Done should include the requested RSA and ECDSA choices, configurable defaults, and support for associating multiple certificates with one proxy host.

Written by the indexing model from the issue text.

Assessment

Tech stack
nginx, typescript
Domain
backend, frontend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.